PT-2020-1749 · Moxa+1 · Moxa Awk-3131A+1

Published 2020-02-25 · Updated 2022-06-13 · CVE-2019-5138

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Moxa AWK-3131A firmware version 1.13

Description An exploitable command injection vulnerability exists in the encrypted diagnostic script functionality. A specially crafted diagnostic script file can cause arbitrary busybox commands to be executed, resulting in remote control over the device. An attacker can send diagnostic scripts while authenticated as a low-privilege user to trigger this issue. The vulnerability is due to the lack of neutralization of special elements used in the operating system command.

Recommendations For Moxa AWK-3131A firmware version 1.13, consider disabling the diagnostic script functionality until a patch is available to prevent exploitation. Restrict access to the device to minimize the risk of remote control. Avoid using the busybox commands in the diagnostic script file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2020-00989

CVE-2019-5138

Affected Products

Moxa Awk-3131A

Busybox

References · 8

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0927 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-5138 · Security Note
• https://osv.dev/vulnerability/CVE-2019-5138 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00989 · Security Note
• https://t.me/cvenotify/31545 · Telegram Post
• https://moxa.ru/novosti/tidings/prod/ustranenie-uyazvimostej-tochek-dostupa-moxa-awk-3131a · Note
• https://moxa.com/en/support/support/security-advisory/awk-3131a-series-industrial-ap-bridge-client-vulnerabilities · Note
• https://t.me/cvenotify/1204 · Telegram Post